Move login related structs and functions to models/login (#17093)

* Move login related structs and functions to models/login

* Fix test

* Fix lint

* Fix lint

* Fix lint of windows

* Fix lint

* Fix test

* Fix test

* Only load necessary fixtures when preparing unit tests envs

* Fix lint

* Fix test

* Fix test

* Fix error log

* Fix error log

* Fix error log

* remove unnecessary change

* fix error log

* merge main branch

26 files changed, 141 insertions, 82 deletions

diff --git a/services/auth/login_source.go b/services/auth/login_source.go
new file mode 100644
index 0000000000..723dd2b1a5
--- /dev/null
+++ b/services/auth/login_source.go
@@ -0,0 +1,41 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
+)
+
+// DeleteLoginSource deletes a LoginSource record in DB.
+func DeleteLoginSource(source *login.Source) error {
+	count, err := db.GetEngine(db.DefaultContext).Count(&models.User{LoginSource: source.ID})
+	if err != nil {
+		return err
+	} else if count > 0 {
+		return login.ErrSourceInUse{
+			ID: source.ID,
+		}
+	}
+
+	count, err = db.GetEngine(db.DefaultContext).Count(&models.ExternalLoginUser{LoginSourceID: source.ID})
+	if err != nil {
+		return err
+	} else if count > 0 {
+		return login.ErrSourceInUse{
+			ID: source.ID,
+		}
+	}
+
+	if registerableSource, ok := source.Cfg.(login.RegisterableSource); ok {
+		if err := registerableSource.UnregisterSource(); err != nil {
+			return err
+		}
+	}
+
+	_, err = db.GetEngine(db.DefaultContext).ID(source.ID).Delete(new(login.Source))
+	return err
+}
diff --git a/services/auth/oauth2.go b/services/auth/oauth2.go
index e79b640ce4..9b342f3458 100644
--- a/services/auth/oauth2.go
+++ b/services/auth/oauth2.go
@@ -12,6 +12,7 @@ import (
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/web/middleware"
@@ -35,8 +36,8 @@ func CheckOAuthAccessToken(accessToken string) int64 {
 		log.Trace("oauth2.ParseToken: %v", err)
 		return 0
 	}
-	var grant *models.OAuth2Grant
-	if grant, err = models.GetOAuth2GrantByID(token.GrantID); err != nil || grant == nil {
+	var grant *login.OAuth2Grant
+	if grant, err = login.GetOAuth2GrantByID(token.GrantID); err != nil || grant == nil {
 		return 0
 	}
 	if token.Type != oauth2.TypeAccessToken {
diff --git a/services/auth/signin.go b/services/auth/signin.go
index a7acb95ba2..a7ad029456 100644
--- a/services/auth/signin.go
+++ b/services/auth/signin.go
@@ -9,6 +9,7 @@ import (
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 
 	// Register the sources
@@ -21,7 +22,7 @@ import (
 )
 
 // UserSignIn validates user name and password.
-func UserSignIn(username, password string) (*models.User, *models.LoginSource, error) {
+func UserSignIn(username, password string) (*models.User, *login.Source, error) {
 	var user *models.User
 	if strings.Contains(username, "@") {
 		user = &models.User{Email: strings.ToLower(strings.TrimSpace(username))}
@@ -50,7 +51,7 @@ func UserSignIn(username, password string) (*models.User, *models.LoginSource, e
 	}
 
 	if hasUser {
-		source, err := models.GetLoginSourceByID(user.LoginSource)
+		source, err := login.GetSourceByID(user.LoginSource)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -78,7 +79,7 @@ func UserSignIn(username, password string) (*models.User, *models.LoginSource, e
 		return user, source, nil
 	}
 
-	sources, err := models.AllActiveLoginSources()
+	sources, err := login.AllActiveSources()
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/services/auth/source/db/assert_interface_test.go b/services/auth/source/db/assert_interface_test.go
index 2e0fa9ba22..a8b137ec48 100644
--- a/services/auth/source/db/assert_interface_test.go
+++ b/services/auth/source/db/assert_interface_test.go
@@ -5,7 +5,7 @@
 package db_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/db"
 )
@@ -15,7 +15,7 @@ import (
 
 type sourceInterface interface {
 	auth.PasswordAuthenticator
-	models.LoginConfig
+	login.Config
 }
 
 var _ (sourceInterface) = &db.Source{}
diff --git a/services/auth/source/db/source.go b/services/auth/source/db/source.go
index 182c05f0df..2fedff3a7e 100644
--- a/services/auth/source/db/source.go
+++ b/services/auth/source/db/source.go
@@ -4,7 +4,10 @@
 
 package db
 
-import "code.gitea.io/gitea/models"
+import (
+	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
+)
 
 // Source is a password authentication service
 type Source struct{}
@@ -26,6 +29,6 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginNoType, &Source{})
-	models.RegisterLoginTypeConfig(models.LoginPlain, &Source{})
+	login.RegisterTypeConfig(login.NoType, &Source{})
+	login.RegisterTypeConfig(login.Plain, &Source{})
 }
diff --git a/services/auth/source/ldap/assert_interface_test.go b/services/auth/source/ldap/assert_interface_test.go
index a0425d2f76..c480119cd3 100644
--- a/services/auth/source/ldap/assert_interface_test.go
+++ b/services/auth/source/ldap/assert_interface_test.go
@@ -5,7 +5,7 @@
 package ldap_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 )
@@ -17,12 +17,12 @@ type sourceInterface interface {
 	auth.PasswordAuthenticator
 	auth.SynchronizableSource
 	auth.LocalTwoFASkipper
-	models.SSHKeyProvider
-	models.LoginConfig
-	models.SkipVerifiable
-	models.HasTLSer
-	models.UseTLSer
-	models.LoginSourceSettable
+	login.SSHKeyProvider
+	login.Config
+	login.SkipVerifiable
+	login.HasTLSer
+	login.UseTLSer
+	login.SourceSettable
 }
 
 var _ (sourceInterface) = &ldap.Source{}
diff --git a/services/auth/source/ldap/source.go b/services/auth/source/ldap/source.go
index d1228d41ae..82ff7313b2 100644
--- a/services/auth/source/ldap/source.go
+++ b/services/auth/source/ldap/source.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/secret"
 	"code.gitea.io/gitea/modules/setting"
@@ -55,7 +56,7 @@ type Source struct {
 	SkipLocalTwoFA        bool   // Skip Local 2fa for users authenticated with this source
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up a LDAPConfig from serialized format.
@@ -109,11 +110,11 @@ func (source *Source) ProvidesSSHKeys() bool {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginLDAP, &Source{})
-	models.RegisterLoginTypeConfig(models.LoginDLDAP, &Source{})
+	login.RegisterTypeConfig(login.LDAP, &Source{})
+	login.RegisterTypeConfig(login.DLDAP, &Source{})
 }
diff --git a/services/auth/source/ldap/source_authenticate.go b/services/auth/source/ldap/source_authenticate.go
index 46478e6029..f302a9d583 100644
--- a/services/auth/source/ldap/source_authenticate.go
+++ b/services/auth/source/ldap/source_authenticate.go
@@ -9,16 +9,17 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/mailer"
 )
 
 // Authenticate queries if login/password is valid against the LDAP directory pool,
 // and create a local user if success when enabled.
-func (source *Source) Authenticate(user *models.User, login, password string) (*models.User, error) {
-	sr := source.SearchEntry(login, password, source.loginSource.Type == models.LoginDLDAP)
+func (source *Source) Authenticate(user *models.User, userName, password string) (*models.User, error) {
+	sr := source.SearchEntry(userName, password, source.loginSource.Type == login.DLDAP)
 	if sr == nil {
 		// User not in LDAP, do nothing
-		return nil, models.ErrUserNotExist{Name: login}
+		return nil, models.ErrUserNotExist{Name: userName}
 	}
 
 	isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
@@ -64,7 +65,7 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 
 	// Fallback.
 	if len(sr.Username) == 0 {
-		sr.Username = login
+		sr.Username = userName
 	}
 
 	if len(sr.Mail) == 0 {
@@ -78,7 +79,7 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		Email:        sr.Mail,
 		LoginType:    source.loginSource.Type,
 		LoginSource:  source.loginSource.ID,
-		LoginName:    login,
+		LoginName:    userName,
 		IsActive:     true,
 		IsAdmin:      sr.IsAdmin,
 		IsRestricted: sr.IsRestricted,
diff --git a/services/auth/source/oauth2/assert_interface_test.go b/services/auth/source/oauth2/assert_interface_test.go
index 4157427ff2..0a1986a3b2 100644
--- a/services/auth/source/oauth2/assert_interface_test.go
+++ b/services/auth/source/oauth2/assert_interface_test.go
@@ -5,7 +5,7 @@
 package oauth2_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 )
@@ -14,9 +14,9 @@ import (
 // It tightly binds the interfaces and implementation without breaking go import cycles
 
 type sourceInterface interface {
-	models.LoginConfig
-	models.LoginSourceSettable
-	models.RegisterableSource
+	login.Config
+	login.SourceSettable
+	login.RegisterableSource
 	auth.PasswordAuthenticator
 }
 
diff --git a/services/auth/source/oauth2/init.go b/services/auth/source/oauth2/init.go
index be31503eef..343b24cf6f 100644
--- a/services/auth/source/oauth2/init.go
+++ b/services/auth/source/oauth2/init.go
@@ -8,8 +8,8 @@ import (
 	"net/http"
 	"sync"
 
-	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 
@@ -74,7 +74,7 @@ func ResetOAuth2() error {
 
 // initOAuth2LoginSources is used to load and register all active OAuth2 providers
 func initOAuth2LoginSources() error {
-	loginSources, _ := models.GetActiveOAuth2ProviderLoginSources()
+	loginSources, _ := login.GetActiveOAuth2ProviderLoginSources()
 	for _, source := range loginSources {
 		oauth2Source, ok := source.Cfg.(*Source)
 		if !ok {
diff --git a/services/auth/source/oauth2/providers.go b/services/auth/source/oauth2/providers.go
index 2196e30492..0fd57a8dbd 100644
--- a/services/auth/source/oauth2/providers.go
+++ b/services/auth/source/oauth2/providers.go
@@ -9,6 +9,7 @@ import (
 	"sort"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 
@@ -87,7 +88,7 @@ func GetOAuth2Providers() []Provider {
 func GetActiveOAuth2Providers() ([]string, map[string]Provider, error) {
 	// Maybe also separate used and unused providers so we can force the registration of only 1 active provider for each type
 
-	loginSources, err := models.GetActiveOAuth2ProviderLoginSources()
+	loginSources, err := login.GetActiveOAuth2ProviderLoginSources()
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/services/auth/source/oauth2/source.go b/services/auth/source/oauth2/source.go
index 7b22383d7e..49bb9a0148 100644
--- a/services/auth/source/oauth2/source.go
+++ b/services/auth/source/oauth2/source.go
@@ -6,6 +6,7 @@ package oauth2
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -27,7 +28,7 @@ type Source struct {
 	SkipLocalTwoFA                bool
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up an OAuth2Config from serialized format.
@@ -41,10 +42,10 @@ func (source *Source) ToDB() ([]byte, error) {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginOAuth2, &Source{})
+	login.RegisterTypeConfig(login.OAuth2, &Source{})
 }
diff --git a/services/auth/source/pam/assert_interface_test.go b/services/auth/source/pam/assert_interface_test.go
index a0bebdf9c6..a151c2f52e 100644
--- a/services/auth/source/pam/assert_interface_test.go
+++ b/services/auth/source/pam/assert_interface_test.go
@@ -5,7 +5,7 @@
 package pam_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/pam"
 )
@@ -15,8 +15,8 @@ import (
 
 type sourceInterface interface {
 	auth.PasswordAuthenticator
-	models.LoginConfig
-	models.LoginSourceSettable
+	login.Config
+	login.SourceSettable
 }
 
 var _ (sourceInterface) = &pam.Source{}
diff --git a/services/auth/source/pam/source.go b/services/auth/source/pam/source.go
index 75aa99e45f..0bfa7cdb06 100644
--- a/services/auth/source/pam/source.go
+++ b/services/auth/source/pam/source.go
@@ -6,6 +6,7 @@ package pam
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -22,7 +23,7 @@ type Source struct {
 	EmailDomain string
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up a PAMConfig from serialized format.
@@ -36,10 +37,10 @@ func (source *Source) ToDB() ([]byte, error) {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginPAM, &Source{})
+	login.RegisterTypeConfig(login.PAM, &Source{})
 }
diff --git a/services/auth/source/pam/source_authenticate.go b/services/auth/source/pam/source_authenticate.go
index 8241aed725..ad6fbb5cce 100644
--- a/services/auth/source/pam/source_authenticate.go
+++ b/services/auth/source/pam/source_authenticate.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/auth/pam"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/services/mailer"
@@ -18,11 +19,11 @@ import (
 
 // Authenticate queries if login/password is valid against the PAM,
 // and create a local user if success when enabled.
-func (source *Source) Authenticate(user *models.User, login, password string) (*models.User, error) {
-	pamLogin, err := pam.Auth(source.ServiceName, login, password)
+func (source *Source) Authenticate(user *models.User, userName, password string) (*models.User, error) {
+	pamLogin, err := pam.Auth(source.ServiceName, userName, password)
 	if err != nil {
 		if strings.Contains(err.Error(), "Authentication failure") {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 		return nil, err
 	}
@@ -54,9 +55,9 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		Name:        username,
 		Email:       email,
 		Passwd:      password,
-		LoginType:   models.LoginPAM,
+		LoginType:   login.PAM,
 		LoginSource: source.loginSource.ID,
-		LoginName:   login, // This is what the user typed in
+		LoginName:   userName, // This is what the user typed in
 		IsActive:    true,
 	}
 
diff --git a/services/auth/source/smtp/assert_interface_test.go b/services/auth/source/smtp/assert_interface_test.go
index bc2042e069..d1c982472f 100644
--- a/services/auth/source/smtp/assert_interface_test.go
+++ b/services/auth/source/smtp/assert_interface_test.go
@@ -5,7 +5,7 @@
 package smtp_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/smtp"
 )
@@ -15,11 +15,11 @@ import (
 
 type sourceInterface interface {
 	auth.PasswordAuthenticator
-	models.LoginConfig
-	models.SkipVerifiable
-	models.HasTLSer
-	models.UseTLSer
-	models.LoginSourceSettable
+	login.Config
+	login.SkipVerifiable
+	login.HasTLSer
+	login.UseTLSer
+	login.SourceSettable
 }
 
 var _ (sourceInterface) = &smtp.Source{}
diff --git a/services/auth/source/smtp/source.go b/services/auth/source/smtp/source.go
index 39c9851ede..487375c304 100644
--- a/services/auth/source/smtp/source.go
+++ b/services/auth/source/smtp/source.go
@@ -6,6 +6,7 @@ package smtp
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -28,7 +29,7 @@ type Source struct {
 	DisableHelo    bool
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up an SMTPConfig from serialized format.
@@ -57,10 +58,10 @@ func (source *Source) UseTLS() bool {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginSMTP, &Source{})
+	login.RegisterTypeConfig(login.SMTP, &Source{})
 }
diff --git a/services/auth/source/smtp/source_authenticate.go b/services/auth/source/smtp/source_authenticate.go
index cff64c69d2..f50baa56a2 100644
--- a/services/auth/source/smtp/source_authenticate.go
+++ b/services/auth/source/smtp/source_authenticate.go
@@ -11,31 +11,32 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/mailer"
 )
 
 // Authenticate queries if the provided login/password is authenticates against the SMTP server
 // Users will be autoregistered as required
-func (source *Source) Authenticate(user *models.User, login, password string) (*models.User, error) {
+func (source *Source) Authenticate(user *models.User, userName, password string) (*models.User, error) {
 	// Verify allowed domains.
 	if len(source.AllowedDomains) > 0 {
-		idx := strings.Index(login, "@")
+		idx := strings.Index(userName, "@")
 		if idx == -1 {
-			return nil, models.ErrUserNotExist{Name: login}
-		} else if !util.IsStringInSlice(login[idx+1:], strings.Split(source.AllowedDomains, ","), true) {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
+		} else if !util.IsStringInSlice(userName[idx+1:], strings.Split(source.AllowedDomains, ","), true) {
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 	}
 
 	var auth smtp.Auth
 	switch source.Auth {
 	case PlainAuthentication:
-		auth = smtp.PlainAuth("", login, password, source.Host)
+		auth = smtp.PlainAuth("", userName, password, source.Host)
 	case LoginAuthentication:
-		auth = &loginAuthenticator{login, password}
+		auth = &loginAuthenticator{userName, password}
 	case CRAMMD5Authentication:
-		auth = smtp.CRAMMD5Auth(login, password)
+		auth = smtp.CRAMMD5Auth(userName, password)
 	default:
 		return nil, errors.New("unsupported SMTP auth type")
 	}
@@ -46,11 +47,11 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		tperr, ok := err.(*textproto.Error)
 		if (ok && tperr.Code == 535) ||
 			strings.Contains(err.Error(), "Username and Password not accepted") {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 		if (ok && tperr.Code == 534) ||
 			strings.Contains(err.Error(), "Application-specific password required") {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 		return nil, err
 	}
@@ -59,20 +60,20 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		return user, nil
 	}
 
-	username := login
-	idx := strings.Index(login, "@")
+	username := userName
+	idx := strings.Index(userName, "@")
 	if idx > -1 {
-		username = login[:idx]
+		username = userName[:idx]
 	}
 
 	user = &models.User{
 		LowerName:   strings.ToLower(username),
 		Name:        strings.ToLower(username),
-		Email:       login,
+		Email:       userName,
 		Passwd:      password,
-		LoginType:   models.LoginSMTP,
+		LoginType:   login.SMTP,
 		LoginSource: source.loginSource.ID,
-		LoginName:   login,
+		LoginName:   userName,
 		IsActive:    true,
 	}
 
diff --git a/services/auth/source/sspi/assert_interface_test.go b/services/auth/source/sspi/assert_interface_test.go
index 605a6ec6c5..1efa69c05b 100644
--- a/services/auth/source/sspi/assert_interface_test.go
+++ b/services/auth/source/sspi/assert_interface_test.go
@@ -5,7 +5,7 @@
 package sspi_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth/source/sspi"
 )
 
@@ -13,7 +13,7 @@ import (
 // It tightly binds the interfaces and implementation without breaking go import cycles
 
 type sourceInterface interface {
-	models.LoginConfig
+	login.Config
 }
 
 var _ (sourceInterface) = &sspi.Source{}
diff --git a/services/auth/source/sspi/source.go b/services/auth/source/sspi/source.go
index 58cb10de1d..68fd6a6079 100644
--- a/services/auth/source/sspi/source.go
+++ b/services/auth/source/sspi/source.go
@@ -6,6 +6,7 @@ package sspi
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -36,5 +37,5 @@ func (cfg *Source) ToDB() ([]byte, error) {
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginSSPI, &Source{})
+	login.RegisterTypeConfig(login.SSPI, &Source{})
 }
diff --git a/services/auth/sspi_windows.go b/services/auth/sspi_windows.go
index d7e0f55242..a4c39b0064 100644
--- a/services/auth/sspi_windows.go
+++ b/services/auth/sspi_windows.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -152,7 +153,7 @@ func (s *SSPI) Verify(req *http.Request, w http.ResponseWriter, store DataStore,
 
 // getConfig retrieves the SSPI configuration from login sources
 func (s *SSPI) getConfig() (*sspi.Source, error) {
-	sources, err := models.ActiveLoginSources(models.LoginSSPI)
+	sources, err := login.ActiveSources(login.SSPI)
 	if err != nil {
 		return nil, err
 	}
@@ -248,7 +249,7 @@ func sanitizeUsername(username string, cfg *sspi.Source) string {
 // fails (or if negotiation should continue), which would prevent other authentication methods
 // to execute at all.
 func specialInit() {
-	if models.IsSSPIEnabled() {
+	if login.IsSSPIEnabled() {
 		Register(&SSPI{})
 	}
 }
diff --git a/services/auth/sync.go b/services/auth/sync.go
index a34b4d1d26..6d69650e5b 100644
--- a/services/auth/sync.go
+++ b/services/auth/sync.go
@@ -8,6 +8,7 @@ import (
 	"context"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 )
 
@@ -15,7 +16,7 @@ import (
 func SyncExternalUsers(ctx context.Context, updateExisting bool) error {
 	log.Trace("Doing: SyncExternalUsers")
 
-	ls, err := models.LoginSources()
+	ls, err := login.Sources()
 	if err != nil {
 		log.Error("SyncExternalUsers: %v", err)
 		return err
diff --git a/services/externalaccount/user.go b/services/externalaccount/user.go
index 45773fdb12..e43b3ca7c5 100644
--- a/services/externalaccount/user.go
+++ b/services/externalaccount/user.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/structs"
 
 	"github.com/markbates/goth"
@@ -15,7 +16,7 @@ import (
 
 // LinkAccountToUser link the gothUser to the user
 func LinkAccountToUser(user *models.User, gothUser goth.User) error {
-	loginSource, err := models.GetActiveOAuth2LoginSourceByName(gothUser.Provider)
+	loginSource, err := login.GetActiveOAuth2LoginSourceByName(gothUser.Provider)
 	if err != nil {
 		return err
 	}
diff --git a/services/pull/commit_status.go b/services/pull/commit_status.go
index c5c930ee0d..f1f351138b 100644
--- a/services/pull/commit_status.go
+++ b/services/pull/commit_status.go
@@ -7,6 +7,7 @@ package pull
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/structs"
 
@@ -129,7 +130,7 @@ func GetPullRequestCommitStatusState(pr *models.PullRequest) (structs.CommitStat
 		return "", errors.Wrap(err, "LoadBaseRepo")
 	}
 
-	commitStatuses, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, models.ListOptions{})
+	commitStatuses, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, db.ListOptions{})
 	if err != nil {
 		return "", errors.Wrap(err, "GetLatestCommitStatus")
 	}
diff --git a/services/pull/pull.go b/services/pull/pull.go
index bd5551b6dc..f7e231379b 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -780,7 +780,7 @@ func getLastCommitStatus(gitRepo *git.Repository, pr *models.PullRequest) (statu
 		return nil, err
 	}
 
-	statusList, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, models.ListOptions{})
+	statusList, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, db.ListOptions{})
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/pull/review.go b/services/pull/review.go
index f65314c45d..081b17cd83 100644
--- a/services/pull/review.go
+++ b/services/pull/review.go
@@ -138,7 +138,7 @@ func createCodeComment(doer *models.User, repo *models.Repository, issue *models
 				Line:     line,
 				TreePath: treePath,
 				Type:     models.CommentTypeCode,
-				ListOptions: models.ListOptions{
+				ListOptions: db.ListOptions{
 					PageSize: 1,
 					Page:     1,
 				},